We use cookies to allow us and selected partners to improve your experience and our advertising. By continuing to browse you consent to our use of cookies. You can understand more and change your cookies preferences here.

Consumer Rights.

Updated: 1 Sep 2021

How to spot a text message scam

Messaging scams can be very convincing, so it’s important to know what to watch out for to stay ahead of the fraudsters.
Which?Editorial team

Scammers are increasingly taking advantage of smartphones and are getting very clever with how they try to take your hard-earned money. 

Our research found that text scams have boomed as consumers have become increasingly reliant on deliveries during the pandemic. Scammers use many different types of messaging systems and apps, like SMS, WhatsApp, Facebook Messenger, Viber, Skype, Google Hangouts, Snapchat and other messaging platforms to try scam you out of your money.

By using identity masking technology to change the name displayed as the sender, scammers often make it look like a legitimate organisation is contacting you via text or a messaging app. This is known as ‘number spoofing’.

If you get sent a scam message, it’s important you don't respond to it and report it so others don’t fall victim. Reporting a scam message is free and it will help stop the spread of these messages, find out how to report a scam.


'FluBot' malware scam delivery message

Watch out for scam delivery messages containing dangerous 'FluBot' malware. 

Known to affect Android devices, these messages have been found to contain a dodgy link to download an app that can infect your phone with malware. The malware can harvest passwords and other personal information, it also accesses contacts to send out further messages.

Always be wary of unsolicited texts, and think twice before you click on a link. If you think you've received a genuine delivery message, but you’re not certain, then contact the delivery company’s official customer service helpline to verify the message. 

If you've received a similar message and you think it’s a scam you can simply delete it. If you'd like to report it then you can do so by forwarding the message to 7726 - a free reporting service provided by phone operators.

If you've received this message and you've already downloaded the infected app then follow these steps:

  • Don't enter any passwords or log into any accounts.
  • Perform a factory reset on your device.
  • After resetting your device you may be prompted to restore from a backup, but do not restore any apps that you've accessed or downloaded since your device was compromised.
  • Once you've restored your device you should change your passwords on your accounts to ensure they are secure

What does a text message scam look like?

Scammers might be getting more cunning at making messages look like the real thing, but there are some signs you can watch out for. 

Message from an unknown number

Most organisations protect their 'Sender ID' so text messages should be from 'HSBC' or 'Royal Mail' instead of a generic number.

Don't always trust the number though as Sender ID names can be hijacked on smartphones.

If in doubt, contact the organisation directly using a verified number from the organisation's official website.

Urgent requests for payments or details

This is a tactic that tries to worry you so you feel the need to act fast. 

Genuine organisations rarely ask you to pay or make account changes via text message without first logging into your account.  

Fake website address

Does the website address match that of the organisation? Make sure the website link belongs to that of the organisation's official domain - for example, www.hermes.com.

Always look up an organisation's details independently to double-check the details.

Spelling errors and odd wording

Banks, government departments and couriers will rarely make spelling or grammatical errors. If the message doesn't make sense, it's a strong giveaway that it's a scam. 

Key Information

Spot a scam bank message

If you get a message claiming to be from your bank, always treat this with caution. 

Your bank should never:

  • Ask for your Pin or internet banking password.
  • Send someone to your home to collect cards or banking information.
  • Ask you to email or text personal or banking information.
  • Email a link where you have to then input your internet banking details.
  • Ask you to authorise a funds transfer which you haven’t requested.
  • Tell you to invest in diamonds, land or other commodities.
  • Ask you to carry out a test transaction.
  • Send you to a mobile app other than their own official app.

If you receive an unexpected message from your bank and you're concerned whether it's genuine or not, you can call your bank back via an official telephone number listed on its website or on the number printed on the back of your debit or credit card. 

How to avoid message scams

Here are a few tips to help you avoid message scams.

Don't follow any links

This is the most effective way to avoid text scams. Links can take you to cloned websites designed to steal your money or personal data. Because links are often shortened to help them fit into the message, it’s not always easy to tell the real ones from the fakes. Clicking on links could also lead you to download malware - malicious software that can take over your phone and access your data.

Don't share personal information

Treat all messages requesting sensitive information - or that link you to websites asking for personal details - with suspicion. Legitimate organisations will never text you to ask for your personal or banking details upfront.

Contact the organisation directly if you're unsure

If you're not sure if a text is real, contact the company that claims to have sent it to check. Use the official contact details listed on the company’s website or documents you might have been sent, if it's your bank then you can usually find its official number on the back of your credit or debit card.

Don't reply

Replying to a fake text, calling the number it’s been sent from or clicking through on suspicious links only lets the scammers know your number is being used. You might be bombarded with even more scam messages and calls. The number has likely been spoofed anyway, which means you’ll probably only be messaging an innocent member of the public who has had their number stolen.

Report it

You report the scam text by forwarding it to 7726 - a free reporting service provided by phone operators. This information is then shared with the police and intelligence agencies working to stop text scams. If you've fallen victim to a text scam, you can report it to Action Fraud, or the police if you live in Scotland.